New answers tagged


AFAIK, syslog-ng will automatically close the connections after a period of inactivity, unless the so_keepalive() option is enabled in the source (the server) or the destination (the client). If you still see activity in the connections, try to set the mark_freq() option to 0.


In theory you could open a process which opens the socket, forks and each of the clients can then read from the socket. But the end result is probably not what you want. Since every read will remove the data from the socket buffer only one of the processes will get the data, i.e. depending on the scheduling sometimes the first child and sometimes the second ...


I'm not sure you can do that (since I don't believe it is a seekable file, but a stream of bytes), but you can have rsyslog write to multiple files, including have it write to, for example, a named pipe, that your custom tool can read from. That would probably be the easiest solution.


Piping the syslog message to netcat will add the hostname. A simple way is to pipe messages using netcat (nc) in the syslog.conf file as follow: . "TAB" | nc RemoteLogServer -u 514 -w 1" A TAB character must be inserted before the pipe symbol.

Top 50 recent answers are included